The VPN authentication bypass depends on having Override Account Disabled Feature which is disabled by default.

The crafted http/https vulnerability is triggered by specially crafted packets, can be triggered on any interface with ASDM enabled and does not require a 3-way handshake be completed (spoofable).

The TCP packet DOS vulnerability also requires specially crafted packets, can be triggered when crafted packets are sent to any TCP based service on the router, can be triggered on transient traffic if the TCP intercept features are enabled and doesn’t require a 3-way handshake be completed (spoofable).

The H.323 packet DOS relies on having H.323 inspection turned on but that is enabled by default, again requires specially crafted packets and doesn’t require a 3-way handshake be completed (spoofable).

The SQL net packet DOS relies on having SQLnet inspection turned on but it is enabled by default, requires specially crafted packets and does not require a 3-way handshake be completed (spoofable).

The ACL bypass vulnerability is a bypass of the implicit deny at the end of the rule set so if your rule sets have an explicit deny at the end, your not vulnerable. You should ALWAYS put an explicit deny rule at the end of all firewall rule sets!

In case you hadn't noticed yet, they've updated one of our favorite tools, Wireshark. The new version includes some security fixes in several of the protocol dissectors (including LDAP). For the Mac fans, there is also an experimental package for MacOS X 10.5.5 and above.

Various sources report that some conficker infected systems are receiving updates now. The update may include a keylogger and other code to exfiltrate data. We will keep this diary updates as we hear more. The update is delivered using the P2P mechanism and not the (disfunct) web sites.